chore(framework): Move and improve routes loader (#8392)
* chore(framework): Move and improve routes loader * cleanup * fix(framework): import
This commit is contained in:
Adrien de Peretti
@@ -1,203 +1,3 @@
|
||||
import { ApiKeyDTO, ConfigModule, IApiKeyModuleService } from "@medusajs/types"
|
||||
import {
|
||||
ContainerRegistrationKeys,
|
||||
ModuleRegistrationName,
|
||||
} from "@medusajs/utils"
|
||||
import { NextFunction, RequestHandler } from "express"
|
||||
import jwt, { JwtPayload } from "jsonwebtoken"
|
||||
import {
|
||||
AuthContext,
|
||||
AuthenticatedMedusaRequest,
|
||||
MedusaRequest,
|
||||
MedusaResponse,
|
||||
} from "../../types/routing"
|
||||
import { authenticate as originalAuthenticate } from "@medusajs/framework"
|
||||
|
||||
const SESSION_AUTH = "session"
|
||||
const BEARER_AUTH = "bearer"
|
||||
const API_KEY_AUTH = "api-key"
|
||||
|
||||
// This is the only hard-coded actor type, as API keys have special handling for now. We could also generalize API keys to carry the actor type with them.
|
||||
const ADMIN_ACTOR_TYPE = "user"
|
||||
|
||||
type AuthType = typeof SESSION_AUTH | typeof BEARER_AUTH | typeof API_KEY_AUTH
|
||||
|
||||
type MedusaSession = {
|
||||
auth_context: AuthContext
|
||||
}
|
||||
|
||||
export const authenticate = (
|
||||
actorType: string | string[],
|
||||
authType: AuthType | AuthType[],
|
||||
options: { allowUnauthenticated?: boolean; allowUnregistered?: boolean } = {}
|
||||
): RequestHandler => {
|
||||
return async (
|
||||
req: MedusaRequest,
|
||||
res: MedusaResponse,
|
||||
next: NextFunction
|
||||
): Promise<void> => {
|
||||
const authTypes = Array.isArray(authType) ? authType : [authType]
|
||||
const actorTypes = Array.isArray(actorType) ? actorType : [actorType]
|
||||
const req_ = req as AuthenticatedMedusaRequest
|
||||
|
||||
// We only allow authenticating using a secret API key on the admin
|
||||
const isExclusivelyUser =
|
||||
actorTypes.length === 1 && actorTypes[0] === ADMIN_ACTOR_TYPE
|
||||
|
||||
if (authTypes.includes(API_KEY_AUTH) && isExclusivelyUser) {
|
||||
const apiKey = await getApiKeyInfo(req)
|
||||
if (apiKey) {
|
||||
req_.auth_context = {
|
||||
actor_id: apiKey.id,
|
||||
actor_type: "api-key",
|
||||
auth_identity_id: "",
|
||||
app_metadata: {},
|
||||
}
|
||||
|
||||
return next()
|
||||
}
|
||||
}
|
||||
|
||||
// We try to extract the auth context either from the session or from a JWT token
|
||||
let authContext: AuthContext | null = getAuthContextFromSession(
|
||||
req.session,
|
||||
authTypes,
|
||||
actorTypes
|
||||
)
|
||||
|
||||
if (!authContext) {
|
||||
const { http } = req.scope.resolve<ConfigModule>(
|
||||
ContainerRegistrationKeys.CONFIG_MODULE
|
||||
).projectConfig
|
||||
|
||||
authContext = getAuthContextFromJwtToken(
|
||||
req.headers.authorization,
|
||||
http.jwtSecret!,
|
||||
authTypes,
|
||||
actorTypes
|
||||
)
|
||||
}
|
||||
|
||||
// If the entity is authenticated, and it is a registered actor we can continue
|
||||
if (authContext?.actor_id) {
|
||||
req_.auth_context = authContext
|
||||
return next()
|
||||
}
|
||||
|
||||
// If the entity is authenticated, but there is no registered actor yet, we can continue (eg. in the case of a user invite) if allow unregistered is set
|
||||
if (authContext?.auth_identity_id && options.allowUnregistered) {
|
||||
req_.auth_context = authContext
|
||||
return next()
|
||||
}
|
||||
|
||||
// If we allow unauthenticated requests (i.e public endpoints), just continue
|
||||
if (options.allowUnauthenticated) {
|
||||
return next()
|
||||
}
|
||||
|
||||
res.status(401).json({ message: "Unauthorized" })
|
||||
}
|
||||
}
|
||||
|
||||
const getApiKeyInfo = async (req: MedusaRequest): Promise<ApiKeyDTO | null> => {
|
||||
const authHeader = req.headers.authorization
|
||||
if (!authHeader) {
|
||||
return null
|
||||
}
|
||||
|
||||
const [tokenType, token] = authHeader.split(" ")
|
||||
if (tokenType.toLowerCase() !== "basic" || !token) {
|
||||
return null
|
||||
}
|
||||
|
||||
// The token could have been base64 encoded, we want to decode it first.
|
||||
let normalizedToken = token
|
||||
if (!token.startsWith("sk_")) {
|
||||
normalizedToken = Buffer.from(token, "base64").toString("utf-8")
|
||||
}
|
||||
|
||||
// Basic auth is defined as a username:password set, and since the token is set to the username we need to trim the colon
|
||||
if (normalizedToken.endsWith(":")) {
|
||||
normalizedToken = normalizedToken.slice(0, -1)
|
||||
}
|
||||
|
||||
// Secret tokens start with 'sk_', and if it doesn't it could be a user JWT or a malformed token
|
||||
if (!normalizedToken.startsWith("sk_")) {
|
||||
return null
|
||||
}
|
||||
|
||||
const apiKeyModule = req.scope.resolve(
|
||||
ModuleRegistrationName.API_KEY
|
||||
) as IApiKeyModuleService
|
||||
try {
|
||||
const apiKey = await apiKeyModule.authenticate(normalizedToken)
|
||||
if (!apiKey) {
|
||||
return null
|
||||
}
|
||||
|
||||
return apiKey
|
||||
} catch (error) {
|
||||
console.error(error)
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
const getAuthContextFromSession = (
|
||||
session: Partial<MedusaSession> = {},
|
||||
authTypes: AuthType[],
|
||||
actorTypes: string[]
|
||||
): AuthContext | null => {
|
||||
if (!authTypes.includes(SESSION_AUTH)) {
|
||||
return null
|
||||
}
|
||||
|
||||
if (
|
||||
session.auth_context &&
|
||||
(actorTypes.includes("*") ||
|
||||
actorTypes.includes(session.auth_context.actor_type))
|
||||
) {
|
||||
return session.auth_context
|
||||
}
|
||||
|
||||
return null
|
||||
}
|
||||
|
||||
const getAuthContextFromJwtToken = (
|
||||
authHeader: string | undefined,
|
||||
jwtSecret: string,
|
||||
authTypes: AuthType[],
|
||||
actorTypes: string[]
|
||||
): AuthContext | null => {
|
||||
if (!authTypes.includes(BEARER_AUTH)) {
|
||||
return null
|
||||
}
|
||||
|
||||
if (!authHeader) {
|
||||
return null
|
||||
}
|
||||
|
||||
const re = /(\S+)\s+(\S+)/
|
||||
const matches = authHeader.match(re)
|
||||
|
||||
// TODO: figure out how to obtain token (and store correct data in token)
|
||||
if (matches) {
|
||||
const tokenType = matches[1]
|
||||
const token = matches[2]
|
||||
if (tokenType.toLowerCase() === BEARER_AUTH) {
|
||||
// get config jwt secret
|
||||
// verify token and set authUser
|
||||
try {
|
||||
const verified = jwt.verify(token, jwtSecret) as JwtPayload
|
||||
if (
|
||||
actorTypes.includes("*") ||
|
||||
actorTypes.includes(verified.actor_type)
|
||||
) {
|
||||
return verified as AuthContext
|
||||
}
|
||||
} catch (err) {
|
||||
return null
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return null
|
||||
}
|
||||
export const authenticate = originalAuthenticate
|
||||
|
||||
@@ -1,99 +1,3 @@
|
||||
import { NextFunction, Request, Response } from "express"
|
||||
import { errorHandler as originalErrorHandler } from "@medusajs/framework"
|
||||
|
||||
import { MedusaError } from "@medusajs/utils"
|
||||
import { Logger } from "../../types/global"
|
||||
import { formatException } from "../../utils"
|
||||
|
||||
const QUERY_RUNNER_RELEASED = "QueryRunnerAlreadyReleasedError"
|
||||
const TRANSACTION_STARTED = "TransactionAlreadyStartedError"
|
||||
const TRANSACTION_NOT_STARTED = "TransactionNotStartedError"
|
||||
|
||||
const API_ERROR = "api_error"
|
||||
const INVALID_REQUEST_ERROR = "invalid_request_error"
|
||||
const INVALID_STATE_ERROR = "invalid_state_error"
|
||||
|
||||
export default () => {
|
||||
return (
|
||||
err: MedusaError,
|
||||
req: Request,
|
||||
res: Response,
|
||||
next: NextFunction
|
||||
) => {
|
||||
const logger: Logger = req.scope.resolve("logger")
|
||||
|
||||
err = formatException(err)
|
||||
|
||||
logger.error(err)
|
||||
|
||||
const errorType = err.type || err.name
|
||||
|
||||
const errObj = {
|
||||
code: err.code,
|
||||
type: err.type,
|
||||
message: err.message,
|
||||
}
|
||||
|
||||
let statusCode = 500
|
||||
switch (errorType) {
|
||||
case QUERY_RUNNER_RELEASED:
|
||||
case TRANSACTION_STARTED:
|
||||
case TRANSACTION_NOT_STARTED:
|
||||
case MedusaError.Types.CONFLICT:
|
||||
statusCode = 409
|
||||
errObj.code = INVALID_STATE_ERROR
|
||||
errObj.message =
|
||||
"The request conflicted with another request. You may retry the request with the provided Idempotency-Key."
|
||||
break
|
||||
case MedusaError.Types.UNAUTHORIZED:
|
||||
statusCode = 401
|
||||
break
|
||||
case MedusaError.Types.PAYMENT_AUTHORIZATION_ERROR:
|
||||
statusCode = 422
|
||||
break
|
||||
case MedusaError.Types.DUPLICATE_ERROR:
|
||||
statusCode = 422
|
||||
errObj.code = INVALID_REQUEST_ERROR
|
||||
break
|
||||
case MedusaError.Types.NOT_ALLOWED:
|
||||
case MedusaError.Types.INVALID_DATA:
|
||||
statusCode = 400
|
||||
break
|
||||
case MedusaError.Types.NOT_FOUND:
|
||||
statusCode = 404
|
||||
break
|
||||
case MedusaError.Types.DB_ERROR:
|
||||
statusCode = 500
|
||||
errObj.code = API_ERROR
|
||||
break
|
||||
case MedusaError.Types.UNEXPECTED_STATE:
|
||||
case MedusaError.Types.INVALID_ARGUMENT:
|
||||
break
|
||||
default:
|
||||
errObj.code = "unknown_error"
|
||||
errObj.message = "An unknown error occurred."
|
||||
errObj.type = "unknown_error"
|
||||
break
|
||||
}
|
||||
|
||||
res.status(statusCode).json(errObj)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @schema Error
|
||||
* title: "Response Error"
|
||||
* type: object
|
||||
* properties:
|
||||
* code:
|
||||
* type: string
|
||||
* description: A slug code to indicate the type of the error.
|
||||
* enum: [invalid_state_error, invalid_request_error, api_error, unknown_error]
|
||||
* message:
|
||||
* type: string
|
||||
* description: Description of the error that occurred.
|
||||
* example: "first_name must be a string"
|
||||
* type:
|
||||
* type: string
|
||||
* description: A slug indicating the type of the error.
|
||||
* enum: [QueryRunnerAlreadyReleasedError, TransactionAlreadyStartedError, TransactionNotStartedError, conflict, unauthorized, payment_authorization_error, duplicate_error, not_allowed, invalid_data, not_found, database_error, unexpected_state, invalid_argument, unknown_error]
|
||||
*/
|
||||
export const errorHandler = originalErrorHandler
|
||||
|
||||
@@ -1,2 +1,2 @@
|
||||
export { authenticate } from "./authenticate-middleware"
|
||||
export { default as errorHandler } from "./error-handler"
|
||||
export { errorHandler } from "./error-handler"
|
||||
|
||||
Reference in New Issue
Block a user